2 Advisories and 1 Update Published – 2-11-21

Today CISA’s NCCIC-ICS published two control system security advisories for products from Rockwell and multiple embedded TCP/IP stacks.

Rockwell Advisory

This advisory describes an uncontrolled search path element vulnerability in the Rockwell DriveTools SP and Drives AOP. The vulnerability was reported by Claroty and Cognite, Rockwell has an update that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker with local access could exploit the vulnerability resulting in privilege escalation and complete control of the system.

TCP/IP Stacks Advisory

This advisory describes nine separate use of insufficiently random values vulnerabilities in multiple open-source and proprietary TCP/IP stacks. The vulnerabilities (nicknamed NUMBER:JACK) were reported by Daniel dos Santos, Stanislav Dashevskyi, Jos Wetzels, and Amine Amri of Forescout Research Labs. Some the affected vendors have new versions that mitigate the vulnerability in their TCP/IP stack.

The nine reported CVE’s (each generally associated with a separate TCP/IP stack vendor) are:

• CVE-2020-27213 - Nut/Net 5.1 - Patch in progress

• CVE-2020-27630 - uC/TCP-IP 3.6.0 - Patched in the latest version of Micrium OS (successor project),

• CVE-2020-27631 - CycloneTCP 1.9.6 - Patched in version 2.0.0,

• CVE-2020-27632 - NDKTCPIP 2.25 - Patched in version 7.02 of Processor SDK,

• CVE-2020-27633 - FNET 4.6.3 - Documentation updated to warn users and recommend implementing their own PRNG [pseudorandom number generator],

• CVE-2020-27634 - uIP 1.0 Contiki-OS 3.0 Contiki-NG 4.5 - No response from maintainers,

• CVE-2020-27635 - PicoTCP 1.7.0 PicoTCP-NG - Version 2.1 removes the default (vulnerable) implementation and recommends users implement their own PRNG,

• CVE-2020-27636 - MPLAB Net 3.6.- Patched in version 3.6.4.

• CVE-2020-28388 Nucleus NET 4.3 -Patched in Nucleus NET 5.2 and Nucleus ReadyStart v2012.12.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to hijack or spoof TCP connections, cause denial-of-service conditions, inject malicious data, or bypass authentication.

NOTE: The “NUMBER:JACK” report explains that “Forescout Research Labs has released an open source script that uses active fingerprinting to detect which stack a target device is running.” {pg 6}.

Commentary: Oh this is going to be a fun one. I foresee lots of equipment vendor advisories in the works as everyone scrambles to try to fix this mess. BTW, the Report notes that an attack on this type of vulnerability in the old IT world was known as a Mitnick Attack.

CodeMeter Update

This update provides new information on an advisory that was originally published on September 8^th, 2020 and most recently updated on December 3^rd, 2020. The new information includes adding links to the vendor alert from Drager.

Public ICS Disclosures – Week of 11-23-19

This week we have two vendor disclosures from Drager and Moxa. We also have two possible 0-day exploits for products from AVEVA.

Drager Advisory

Drager published an advisory describing two vulnerabilities in their SC Monitoring product line. The vulnerabilities were reported by Jeroen Slobbe and Max Grim. The products have reached end-of-life and no mitigation measures are being offered by Drager.

The two reported vulnerabilities are:

• Denial of service; and

• Hard-coded credentials

Moxa Advisory

Moxa published an advisory concerning the URGENT/11 vulnerabilities. They report that none of their products are affected.

AVEVA Exploits

Chuyreds published exploit code for a denial of service vulnerability in the AVEVA InTouch Machine. There is no report of a CVE number or vendor coordination in the document so this may be a 0-day vulnerability.

Chuyreds published exploit code for a denial of service vulnerability in the AVEVA InduSoft Web Studio. There is no report of a CVE number or vendor coordination in the document so this may be a 0-day vulnerability.

NOTE: The exploits look very similar, so this probably reflects a common vulnerability in the two products. I do not see an AVEVA advisory for the two products with a similar vulnerability.

Public ICS Disclosures – Week of 09-05-19

This week we have URGENT/11 updates from three ICS vendors; seven new vendor disclosures from Siemens, Schneider (4), Beckhoff (2) and Drager; six updates of previously issued advisories from Siemens (2), Schneider (3) and Yokogawa, and one exploit of a previously reported vulnerability for products from SMA Solar Technology.

URGENT/11 Updates

ABB AC 800PEC;

Schneider;

Rockwell;

Siemens Advisory

Siemens published an advisory describing twelve vulnerabilities in the Siemens SIMATIC WinAC

RTX (F) 2010. These vulnerabilities are known as Spectre, Meltdown, Spectre-NG, Foreshadow, L1 Terminal Fault (L1TF), ZombieLoad, and Microarchitectural Data Sampling (MDS). These vulnerabilities were reported by various researchers. Siemens has an update that mitigates the vulnerabilities.

Schneider Advisories

Modicon Controllers Advisory #1

Schneider published an advisory describing a file and directory information disclosure vulnerability in the Schneider Modicon brand of programmable logic controllers. The vulnerability was reported by Jared Rittle (Cisco Talos); the report includes proof-of-concept (POC) code. Schneider provides generic workarounds to mitigate the vulnerability.

Modicon Controllers Advisory #2

Schneider published an advisory describing six vulnerabilities in the Schneider Modicon brand of programmable logic controllers. The vulnerabilities were reported by Jared Rittle and Patrick DeSantis (Cisco Talos) (the CVE links below are to the individual reports which contain POC code). Schneider provides generic workarounds to mitigate the vulnerability.

The six reported vulnerabilities are:

• Uncaught exception (5) - CVE-2019-6841, CVE-2019-6842, CVE-2019-6843, CVE-2019-6844 and CVE-2019-6847; and

• Clear-text transmission of sensitive information - CVE-2019-6846;

Modicon Controllers Advisory #3

Schneider published an advisory describing a clear-text transmission of sensitive information vulnerability in the Schneider Modicon brand of programmable logic controllers. The vulnerability was reported by Jared Rittle (Cisco Talos). Schneider provides generic workarounds to mitigate the vulnerability.

Modicon Controllers Advisory #4

Schneider published an advisory describing three vulnerabilities in the Schneider Modicon brand of programmable logic controllers. The vulnerabilities were reported by Jared Rittle (Cisco Talos) (the CVE links below are to the individual reports which contain POC code). Schneider provides generic workarounds to mitigate the vulnerability.

The three reported vulnerabilities are:

• Uncaught exception vulnerability - CVE-2019-6848; and

• Information exposure (2) - CVE-2019-6849 and CVE-2019-6850

Beckhoff Advisories

TwinCat Advisory

VDE-CERT published an advisory describing a divide by zero vulnerability in the Beckhoff TwinCAT real-time controller. The vulnerability was reported by Andreas Galauner from Rapid7. The Beckhoff advisory on this vulnerability reports that they are working on an update to mitigate the vulnerability.

CE Remote Display Advisory

Beckhoff published an advisory describing an incorrect login response vulnerability in the Beckhoff CE Remote Display. The vulnerability was reported by Chen Jie from NSFOCUS and Tijl Deneut from University Howest. Beckhoff has updates that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Drager Advisory

Drager has published an advisory describing three vulnerabilities in the Drager Infinity® M300 patient monitor. Drager is self-reporting the vulnerabilities. Drager will be releasing a new version to mitigate the vulnerabilities in March 2020.

The three reported vulnerabilities are:

• Network DDOS attack;

• Repeated DDOS attacks; and

• Information exposure

Siemens Updates

Industrial Products Update

Siemens published an update for an advisory that was originally published in May of 2017 and most recently updated on February 14^th, 2019. The new information includes:

• Merged WinAC RTX 2010 SP2 and WinAC RTX F 2010 SP2 to SIMATIC WinAC RTX (F) 2010; and

• Added mitigation information for SIMATIC WinAC RTX (F) 2010

NOTE: I expect NCCIC-ICS to update their advisory this week.

SIMATIC S7 Update

Siemens published an update for an advisory that was originally reported in November 2018 and most recently updated on August 13^th, 2019. The new information includes:

• Added CVE-2019-1125, CVE-2019-15666 and CVE-2019-15903; and

• Removed CVE2018-19591 from the list of fixed vulnerabilities

NOTE: NCCIC-ICS has not addressed these Linux vulnerabilities.

Schneider Updates

Floating License Manager Update

Schneider published an update for an advisory that was originally published in May 2019 and most recently updated on September 10^th, 2019. The new information is updated remediations for EcoStruxure Power

Monitoring Expert.

NOTE: NCCIC-ICS may update their advisory, but they did not update for the last Schneider update.

SoMachine Update

Schneider published an update for an advisory that was originally published on August 13^th, 2019. The new information is adding SoMove FDT to the list of affected products.

NOTE: NCCIC-ICS did not address this vulnerability.

Embedded Web Server Update

Schneider published an update for an advisory that was originally published in November 2018 and most recently updated on June 11^th, 2019. The new information includes mitigation information for the M340 controller.

 NOTE: NCCIC-ICS did not address these vulnerabilities.

Yokogawa Update

Yokogawa published an update for an advisory that was originally published on September 27^th, 2019. The new information includes updated affected version data and mitigation measures for Exaquantum.

NOTE: NCCIC-ICS will probably update their advisory this week.

SMA Exploit

Borja Merino published an exploit for a cross-site forgery vulnerability in the SMA Sunny WebBox. An advisory for the vulnerability was published on October 8^th, 2019.

Public ICS Disclosures – Week of 09-07-19

This week we have 11 vendor disclosures for products from Siemens (3), Schneider (3), Bosch (2), 3S, Eaton, and Draeger. We also have 3 vendor updates from Schneider (2) and Siemens.

Siemens Advisories

DejaBlue Advisory

Siemens published an advisory describing the Microsoft Windows® DejaBlue vulnerabilities in the Siemens Healthineers Products. In most of the affected products Siemens is recommending applying the appropriate MS patches.

Siemens repeatedly makes the following observation: “The compatibility of Microsoft security patches with products from Siemens Healthineers that are beyond their End of Support date cannot be guaranteed.”

RUGGEDCOM URGENT/11 Advisory

Siemens published an advisory describing the Wind River URGENT/11 vulnerabilities in the Siemens RUGGEDCOM Win base stations. Siemens provides generic workarounds for the vulnerabilities.

SINEMA Advisory

Siemens published an advisory describing four vulnerabilities in the Siemens r SINEMA Remote Connect Server. The vulnerabilities were reported by Hendrik Derre and Tijl Deneut from HOWEST. Siemens has a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Password guessing - CVE-2019-13918;

• Privilege escalation - CVE-2019-13919;

• Cross-site request forgery - CVE-2019-13920; and

• Password hash - CVE-2019-13922

Siemens Update

Siemens published an update for an advisory that was originally published on June 9^th, 2019. This update provides corrected version information and mitigation information for:

• FieldPG M4;

• FieldPG M5; and

• ITP1000

Schneider Advisories

U.Motion Server Advisory

Schneider published an advisory describing six vulnerabilities in the Schneider U.motion din rail and touch panel servers. The vulnerabilities were reported by Zhu Jiaqi and Constantin-Cosmin Craciun. Schneider has a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Cross-site scripting - CVE-2019-6835;

• Improper access control (3) - CVE-2019-6836, CVE-2019-6838 and CVE-2019-6839;

• Server-side request forgery - CVE-2019-6837; and

• Format string - CVE-2019-6840

Modicon Quantum Advisory

Schneider published an advisory describing an improper check for unusual or exceptional conditions vulnerability for the Schneider Modicon Quantum 140 NOE771x1 controllers. The vulnerability is self-reported. Schneider has a new version that mitigates the vulnerability.

TwidoSuite Advisory

Schneider published an advisory describing two vulnerabilities in the Schneider TwidoSuite product. The vulnerability is self-reported. This product is no longer supported.

The two reported vulnerabilities are:

• Untrusted search path;

• Input validation

Schneider Updates

BlueKeep Update

Schneider published an update for an advisory that was originally published on July 12, 2019. The update includes:

• Exploit information; and

• Updated affected product versions

 Floating License Manager Update

Schneider published an update for an advisory that was originally published on May 14^th, 2019. The update provides updated affected product information.

Bosch Advisories

Bosch published two advisories (here and here) describing vulnerabilities in the Access Professional access control system. The vulnerabilities were reported by Oleksii Orekhov. Bosch has a new version that mitigates the vulnerabilities. There is no indication that Orekhov has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Hard-coded credentials - CVE-2019-11898; and

• Improper access control - CVE-2019-11899

3S Advisory

3s published an advisory describing a stack-based buffer overflow vulnerability in the CODESYS V2.3 ENI servers. This vulnerability was reported by Chen Jie from NSFOCUS. 3S has an update that mitigates the vulnerability. There is no indication that Chen has been provided an opportunity to verify the efficacy of the fix.

Eaton Advisory

Eaton published an advisory describing multiple undisclosed vulnerabilities in the Eaton Intelligent Power Protector. The vulnerabilities are apparently self-reported. Eaton has a new version that mitigates the vulnerabilities.

NOTE: Eaton continues to publish unusable security advisories.

Drager Advisory

Drager published an advisory describing the Microsoft Windows® DejaBlue vulnerabilities in Drager products.

Public ICS Disclosures – Week of 01-19-19

This week we have vendor notifications from Bosch, AVEVA, Drager, Yokogawa and BD. We also have an exploit of a previously disclosed set of vulnerabilities for products from NUUO.

Bosch Advisory

Bosch has published an advisory for two vulnerabilities in their DIVAR 400 & 600 digital recorders. The vulnerabilities were reported by Maxim Rupp. Bosch has provided generic workarounds to mitigate the vulnerability. There is no indication that Rupp has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper access control; and

• Unprotected credentials

AVEVA Advisory

AVEVA has published an advisory for three vulnerabilities in their Wonderware System Platform. The vulnerabilities were reported by Vladimir Dashchennko from Kaspersky Lab. AVEVA has a new update that mitigates the vulnerabilities. There is no indication that Daschennko has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Insufficiently protected credentials;

• Execution with unnecessary privilege; and

• Missing authorization

These vulnerabilities were coordinated through ‘ICS-CERT’ so I expect that we will see an advisory from NCCIC-ICS next week (though they may have a backlog to work through now that the Federal Funding Fiasco is at least temporarily over).

Drager Advisory

Drager published an advisory that is not technically for a control system vulnerability. They are advising customers of a number of reported fraudulent emails from apparent Drager email addresses that have been part of schemes to have companies make payments to non-Drager accounts.

Yokogawa Advisory

Yokogawa has published an advisory for an access control vulnerability in their License Manager Service. The vulnerability was reported by Kaspersky Lab. Yokogawa has patches that mitigate the vulnerability. There is no indication that Kaspersky Lab has been provided an opportunity to verify the efficacy of the fix.

BD Advisory

BD has published an advisory  (actually an update for an advisory that was issued last summer) for a Microsoft Windows vulnerability in the task scheduler that affects a number of BD products. BD will patch the software during the next patch cycle.

NUOO Exploit

Pedro Ribeiro published a set of exploits for the NUOO CMS software management platform. The vulnerabilities were reported by NCCIC-ICS in an advisory published on October 12^th, 2018 and updated on November 20^th, 2018. Ribeiro was the one who originally reported the NUOO vulnerabilities to NCCIC-ICS.

In addition to publishing four Metasploit modules as part of his exploit report, Ribeiro reports that one of the vulnerabilities reported through NCCIC-ICS (Use of hard-coded credentials - CVE-2018-17894) has not actually been fixed as was reported in the NCCIC-ICS advisory.

Reading the exploit report from Ribeiro provides an interesting look into the coordinated disclosure process where the vendor is less than cooperative. Pedro has all sorts of nice things to say about the folks he worked with at ‘ICS-CERT’ during the two-year process but suffice to say he is disappointed with NUOO.

Two Advisories Published – 01-22-19

Today the DHS NCCIC-ICS published a control system security advisory for products from Johnson Controls and a medical device security advisory for products from Drager.

Johnson Controls Advisory

This advisory describes two vulnerabilities in the Johnson Controls Facility Explorer. The vulnerabilities were reported by Tridium. Johnson Controls has new versions that mitigate the vulnerabilities. There is no indication that Tridium has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Path traversal - CVE-2017-16744; and

• Improper authentication - CVE-2017-16748

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit these vulnerabilities to allow an attacker to read, write, and delete sensitive files to gain administrator privileges in the Facility Explorer system.

Drager Advisory

This advisory describes three vulnerabilities in the Drager Infinity Delta patient monitoring devices. The vulnerabilities were reported by Marc Ruef and Rocco Gagliardi, of scip AG. Drager has new versions that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Improper input validation - CVE-2018-19010;

• Information exposure through log files - CVE-2018-19014; and

• Improper privilege management - CVE-2018-19012

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerabilities to cause information disclosure of device logs, denial of service through device reboots of the patient monitors, and privilege escalation.

NOTE: The Drager security advisory adds an additional vulnerability for one of the affected products; “Several 3rd party components were found outdated and vulnerable to several published security vulnerabilities.”